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In order to benefit from IP-based intercepts, a 
necessary condition is the ability to gain access 
to the relevant data. Various agencies and 
organizations will have different existing ways 
to intercept & transport suspect’s traffic. This 
document outlines how FoxReplayCovert can 
facilitate a stand-alone Interception capability. 
Such a capability can provide a vital supporting 
role in mission-related activities, in unfriendly 
or even hostile environments. 

This document outlines the specifics of how 
FoxReplay can help an organization benefit 
from IP intercepts generated in the field. 
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Context 

To reliably and dependably benefit from IP based intercepts, the following 
functionality must be present: 

1. Interception 

2. Storage & Transmission 

3. Collection 

4. Processing & Analysis 

In many LI environments, items 1 and 2 are lawfully performed by tele- 
communications companies (carriers), whereas item 3 is often run by a 
centralized government agency. In all but a very few exceptions, the actual 
processing and analysis of intercepted IP traffic is performed by government 
agencies themselves. 

In some cases however, items 1 through 4 are the responsibility of the 
government organization. 

l. Interception 

Gaining access to IP-data carrying relevant information (email, chat traffic, 
voice over IP) is the first step in benefiting from IP Intelligence. 

Friendly environments 

Even in friendly environments, covert interception may be required if there 
is no formalized alternative. To support such use, FoxReplayCovert equip- 
ment is small, quiet and unobtrusive (both on the network and physically). 

Unfriendly environments 

When interception needs to occur in an unfriendly or even hostile environ- 
ment, additional factors come into play. Therefore, to satisfy the needs of an 
unfriendly environment, FoxReplayCovert is available in a rugged version, 
and, suitable for quick deployment and can operate in environments with no 
(reliable) electrical power. Finally, FoxReplayCovert can operate comple- 
tely automated so there is no need for configuration during deployment. 

Selection 

Often, analysts will be interested in only specific traffic, for example, to 
focus on VoIP and not on WWW. In other cases, only certain email addres- 
ses or certain computers within an internet cafe will need to be targeted. 
FoxReplayCovert can be configured to focus on specific kinds of traffic, such 
as on specific email or IP addresses. 

Covert 

FoxReplayCovert is available in many different forms, some of which look 
exactly like ‘branded’ networking equipment. In addition, they can also 
operate like such normal networking equipment. Various editions of our 
FoxReplayAnalyst software tools differ in size and capability, to fit exactly 
mission needs. 
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2. Storage & Transmission 

Once IP packets have been intercepted, they must be stored (perhaps brief- 
ly) until it is possible to transmit them to the location where analysis will 
be performed. For many purposes, the FoxReplayCovert devices can store 
adequate amounts of data without further aid. If larger amounts of data 
need to be buffered, the solution can be customized to retain terabytes of 
data. Transmission of packets can either occur ‘in-line’ with intercepted 
traffic, or use a dedicated out-of-band connectivity. In-line transmission is 
fully auto-configuring, whereas dedicated transport may require VSAT or 
other mobile IP connectivity. 

3. Collection 

Before analysis, the captured, stored and transmitted data must be col- 
lected (‘received’). Such collection can occur more or less covertly. When 
operating in more ‘steady’ environments, collection can be performed over 
VSAT-based IP networks (for both in-line and dedicated transmission). 

It is however also possible to deliver intercepted data to anonymous mail 
boxes , in encrypted form. Any kind of internet access can then be utilized 
to extract the intercepted data from such mailboxes. 

This mode allows a FoxReplayCovert device to operate without any further 
infrastructure. 

4. Processing & Analysis 

The established FoxReplayAnalyst solution can also be delivered on a rug- 
gedized laptop, including complete ‘restart from scratch’ ability, and other 
features that make it possible to use the software in the field, without 
requiring technical support. 
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